Embedded custom-app extension point

Decision 2026-07-04: launch scope. The iframe + auth-handshake extension framework per docs/architecture/iframe-modules.md — approved external apps embed inside the portal shell with tenant-scoped auth handoff. The framework ships at launch; specific embedded apps remain per-approval post-launch (explicitly excluded from scope creep).